Align DNS doctor ports with CoreDNS bindings

[aidankhogg]

Motivation

• Ensure the doctor preflight readiness checks for DNS reflect the actual ports CoreDNS publishes so port readiness checks do not diverge from runtime behavior.
• Make CoreDNS publish both UDP and TCP on port 53 because DNS uses UDP for normal queries and TCP for truncation/large responses, and keep the doctor probes aligned with that.
• Provide clearer guidance for macOS/Docker Desktop users about privileged port 53 binding and the option to use an alternate host DNS port.

Description

• Add COREDNS_PORT_BINDINGS and COREDNS_PORTS constants and update _deploy_coredns to expose and bind both 53/udp and 53/tcp using these shared constants in netengine/handlers/dns.py.
• Keep both KnownPort(53, "tcp", "DNS") and KnownPort(53, "udp", "DNS") in KNOWN_LOCAL_PORTS and ensure the doctor checks remain required for both protocols in netengine/diagnostic/preflight.py.
• Improve the port 53 hint _DNS_PORT_HINT to mention macOS with Docker Desktop, privileged host-port binding, and a configurable alternate DNS host port in netengine/diagnostic/preflight.py.
• Add tests in tests/test_doctor.py that assert the doctor’s required DNS ports match COREDNS_PORT_BINDINGS and that the updated port-53 hint contains the macOS/Docker Desktop guidance.

Testing

• Ran python -m pytest tests/test_doctor.py -q, and the test suite completed successfully (17 passed).
• Ran linter checks with ruff on the modified files and they passed with no issues.

---

Codex Task